Stealth Stealer: PhantomVAI Loader Uses Steganography in Images to Inject Katz Stealer and Evade Sandboxes

Researchers from Palo Alto Networks’ Unit 42 have uncovered a multi‑stage phishing campaign delivering a stealthy loader called PhantomVAI Loader, which deploys a range of information-stealing malware including Katz Stealer, AsyncRAT, XWorm, FormBook and DCRat across industries worldwide. The infection chain begins with a phishing email containing a malicious JavaScript or VBS attachment disguised as a sales or legal document, with some messages using homograph attacks to bypass email defenses.

Once opened, the script decodes a Base64‑encoded PowerShell script that downloads a GIF or image file hiding the loader payload, with the encoded data decoded into the .NET‑based PhantomVAI Loader. The loader performs virtualization checks to evade sandboxes, creates persistence, and injects the payload into MSBuild.exe, a process hollowing technique that aids stealth.

Katz Stealer, advertised as MaaS by a user named katzadmin on BreachForums in April 2025, collects data such as browser credentials, cryptocurrency wallet data and messages, while the campaign targets organisations across manufacturing, education, utilities, technology, healthcare, government and information sectors, according to Unit 42 telemetry.